TRA Release History

2025 R1 Authorized 31/Dec/25

Corrected links and references to archived or rescinded Executive Orders and OMB Memoranda

Added content and links to new and prior Executive Orders and OMB Memoranda

BR-F-5: Any System That Processes CMS Data ... ATO

BR-F-8: Backup CMS Data

Changed citation to FISMA

Deprecation of the Cloud Protection Manager (CPM), recommended replacement by AWS Backups

BR-DR-2

BR-DR-5

Design for Caching

Introducing New Software

Updated and clarified caching guidance

Expanded and clarified

BR-UX-3: Provide Multilingual Capability

BR-UI-12: Authentication

Added references and note regarding Executive Order 14224, “Designating English as the Official Language of the United States”

Updated language and references regarding anonymous access and password complexity

OSS Introduction. Overview, Strategy

OSS Business Rules

Enterprise Data Business Rules

IDR Enterprise Data Product

Enterprise Data Mesh

EUDC

Business rules preserved from Enterprise Data Mesh

Introduction of IDR Enterprise Data Product (EDP)

Reflects decommission of Enterprise Data Mesh and EUDC, introduction of IDR Enterprise Data Product (EDP)

2024 R3 Authorized 04/Oct/24

SaaS Introduction

SaaS Business Rules

File Transfer Introduction

File Transfer Business Drivers

BR-SA-10: Applications in CMS Data Centers May Not Use Some Native Email Protocols

CMS Strategic Guidance and Preferred Solutions

2024 R2.1 Released 30 Apr 24

2024 R2 Authorized 23 May 24

Introduction to Data Management

File Transfer

2024 R1.1 Released 4 Apr 24

2024 R1 Authorized 6 Feb 24

Guiding Principles

CMS Strategic Guidance & Preferred Solutions

Introduction to Data Management

Enterprise Data Sharing & Governance

New content describes major CMS data services and data sources.

New guidance emphasizes how CMS data must be kept within CMS authorization boundaries.

Application Development

Infrastructure Services

Blockchain Technology

Fast Data

2023 R2 Authorized 6 Sep 23

Updated Business Rule to reflect new CMS email architecture based on move from HHS to CMS tenant.

BR-SA-1: Use CMS Shared Services

BR-SA-2: Integrate with the CMS Identity Management Services

BR-SQ-5: Manual Code and Design Reviews Are Mandatory

2023 R1.1 Released 14 Feb 23

Legacy Volume, Chapter, and Section references changed to hyperlinks to content titles

Selected business rule references now link to the rules

2023 R1 Authorized 14 Feb 23

CMS Services Framework

CMS Services Framework Guidance

CMS Services Framework Services

Services Framework

Services Framework - Mediation Services

Services Framework Summary

CMS Multi-Zone Architecture

Significant updates across the entire Services Framework section. Includes new content and clarification of services framework concepts and relationship to multi-zone architecture.

Also includes re-organization of the content, so some prior topics are removed and content shifted into different topics

Software as a Service Introduction

BR-SAAS-6: Perform Configuration Management

2022 R1.1 Released 1 Nov 22

Need a historical account of all changes made to the TRA:

Added the complete change log as its own section. It will be redacted for the external versions. It will not contain "in-flight" changes.

Services Framework

Glossary

Services Framework - Framework

Glossary

2022 R1 Authorized 14 Jul 22

Legacy footnotes embedded in text (hover) are showing obsolete or redundant information:

Removed (hover) footnote text where applicable. (ongoing)

The titles/names of over 40 controls were changed in ARS 5:

Updated all TRA references to these controls to align with the new ARS 5 naming

21 new security controls were added to CMS baselines with ARS 5:

Added TRA references to the new controls as appropriate in various business rules throughout the TRA content

Legacy privacy controls migrated into other ARS 5 controls:

References to legacy AR, DI, and DM controls have been updated across the TRA based on the NIST recommended mapping to new controls

In ARS 5, legacy CMS controls have been withdrawn and mapped into other standard controls:

References to the legacy CMS specific controls have been mapped to new controls based on guidance from the CMS ISPG policy team.

BR-ACID-6: Minimize Retention of PII in Identity Life-Cycle Management

BR-SAAS-4: Plan for Data Archival to Comply with Federal Records Management

Updated to reflect ARS changes:

Replaced withdrawn security control DM-2 with MP-6, SI-12, and SI-12(3)

Introduction (Foundation)

Disaster Recovery (Infrastructure Services)

TRA list of References (References)

ARS version change after update to ARS 5 :

Change to url security.cms.gov and https://security.cms.gov/policy-guidance/cms-acceptable-risk-safeguards-ars where applicable

CMS TRA Services Framework Architecture, Guidance, Services

CMS TRA Services Framework, Protecting Services, Framework Summary

Various topic places through the TRA that contain related information about the TRA Services Framework.

They can be found here, here, here, here, and here.

Added working breadcrumb links at the top of all pages.

Moved previous and next page icons to left bottom, out of the content and made them fixed. They no longer scroll with the content.

Some audience were unclear if the Services framework was mandatory:

Clarified language to state the CMS Services Framework is an option and that multi-tier is still valid (content since removed).

2021 R2.2Released 3 Mar 22

Inclusive and sensitive terminology ("man-made"):

Updated language to "human-caused"

Security update to API connector:

Applied new version of axios (v3.3) code.

2021 R2.1 Released 10 Feb 22

Updated table and columns formatting

Navigation - provided additional links to changed material

Transform from pdf to online - duplicate figure and table numbers no longer applicable in web version:

Removed table and figure numbers

Transform from pdf to online:

Sequenced all url names to match order of content

Transform from pdf to online:

Updated hard references of "Volumes" for online

Transform from pdf to online:

Changed section number reference to link

Transform from pdf to online:

Updated hard references of "Volumes" for online

Transform from pdf to online:

Updated hard references of "Volumes" for online

2021 R2 Authorized 6 Jan 22

Change wording to indicate that these networks operate at a high level of trust (vs explicitly trusted)

Edited the text to remove the explicit trust reference, indicating that CMSNet and CMS data centers operate at an elevated trust level, but best practice would be to authenticate all network connections (aligns to future zero trust security model being pushed through the recent Executive Order on Cybersecurity).

Remove IBM reference, but can retain reference to logical partitions. Cite the requirement for an AAA (Authorization, Auditing, Authentication) tool. RACF can be generically referred to as an example of such.

After review with TRB, the IBM references can remain. Added AA references and removed specific naming of RACF.

CMS Performance Management Systems;

BR-KSM-1: KSM Auditing Must Be Enabled and Connected to CMS Logging Infrastructure

Data and Database Management;

BR-DBM-3: Systems Must Meet CMS Data and Database Management Standards

Packaging and Delivery;

BR-PD-2: Software Target Packaging Must Be in Either the Operating System or Language Platform Native Form

Business Rules and Recommended Practices (Open Source);

BR-OSS-12: CMS-Released OSS Code Must Include Automated Unit Tests, Build Scripts and Be Checked for Software Vulnerabilities

Diagram depicts various specific tool names.

Added text to document to indicate a "sample" diagram.

2021 R1.1 Released 1 Sep 21